CVE-2026-86143

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a...

CVE-2026-86143

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a...

CVE-2026-86143

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a...

CVE-2026-86139

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow...

CVE-2026-86139

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow...

CVE-2026-86139

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow...

CVE-2026-86139

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow...

EUVD-2026-71832

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow...

CVE-2026-86139

libxml2 before 2.15.4 contains an integer overflow in the xmlURIEscapeStr function within uri.c. The upstream fix (commit 8edbbdb0) adds a zero-length guard after xmlStrlen to catch cases where the function returns 0 for a non-empty input, preventing the overflow. According to Red Hat, the flaw c...

CVE-2026-86139

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow...

CVE-2026-86138

In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow...

CVE-2026-86138

CVE-2026-86138 affects libxml2 before version 2.15.4 . The root cause is an integer overflow in the xmlDictAddQString function (dict.c), which results in a heap-based buffer overflow . A local attacker can leverage this to execute arbitrary code , compromising system integrity and confidentiality...

EUVD-2026-71831

In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow...

CVE-2026-86138

In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow...

CVE-2026-86138

In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow...

CVE-2026-86138

In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow...

CVE-2026-86138

In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow...

[slackware-security] libxml2

New libxml2 packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/libxml2-2.11.9-i586-10slack15.0.txz: Rebuilt. This update fixes bugs and security issues: xmlregexp: Prevent out-of-bounds read in NX...

SUSE CVE-2026-71479

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, maxtokens, maxcompletiontokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversio...

SUSE CVE-2026-73564

frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeats the payload bound...